Zyxel has finally gotten around to patching a zero-day vulnerability in its GS1900 series network switches that hackers were using like a free buffet, affecting nearly 1,000 devices worldwide. Apparently, waiting to secure these things was just a fun little game of "how many can we lose before we fix it?"
Here’s the scoop: The vulnerability, called CVE-2026-107441 (catchy name, right?), is an out-of-bounds write flaw. Translating that into layman's terms: it lets anyone with access to the network send specially crafted HTTP requests to execute operating system commands. Spoiler: it’s not a good thing.
This charming glitch affects ten of Zyxel's switch models, and in the spirit of efficiency, they released security updates on October 22—after the attackers had already made themselves at home. A security advisory followed on November 3, just in case anyone missed it.
A Mix-Up of Epic Proportions
Initially, this vulnerability was mistaken for an older one, CVE-2026-7273, which Zyxel had supposedly fixed months before the hackers decided to come over for a visit. But as it turns out, the problem was still lurking, waiting for someone to accidentally leave the front door wide open.
Hacking hijinks began around August 17, 2026, when some crafty cybersecurity company noticed a group of Chinese-speaking miscreants, dubbed Kapibala, making off with device configurations and credentials. After all, if there’s one thing hackers love more than money, it's access to your device’s innermost secrets.
The goofiness continued when GreyNoise identified 996 devices compromised across 48 countries. The attackers exploited the vulnerability, executing commands remotely and gathering precious data like scripts that had all the juicy details about the devices, including hashed root credentials. Yum!
A Few Missteps
While GreyNoise flailed about attributing the exploitation to the earlier flaw, researchers at Binarly were like, “Hold my coffee.” They discovered it was a whole separate, previously unknown vulnerability at play.
After digging through the attackers' infrastructure and finding a Python exploit, Binarly confirmed that the bad guys were still able to exploit switches, even after Zyxel's attempts at a security fix. This was thanks to some crafty parameter counter shenanigans, allowing the exploit to overwrite memory and execute commands without needing any authentication. Because why not skip the boring stuff, right?
Zyxel finally acknowledged this new vulnerability on October 11 and sprang into action. On October 22, they released updates that limit parameter sizes and validate the parameter count, essentially locking the door after the horse had bolted.
Take Action, Please
So, if you’re one of those poor souls managing an affected Zyxel GS1900 switch, now would be a stellar time to update your firmware. Or you know, you could just let hackers have a fun little party in your network. Your call!
